Data protection
Data processing addendum
A draft baseline for processing customer content. It is not operator-ready until the final entity, subprocessors, security commitments, transfer terms, and annexes are completed and approved.
This policy is issued by HelioDesk. Legal notices are available through the support page. Configure the final legal entity and mailbox before public launch.
01Roles and scope
The customer is controller or business and the operator is processor or service provider for personal data in customer content. Processing is limited to providing, securing, supporting, and improving the contracted service according to documented instructions.
02Processing details
- Subjects may include customer personnel, end users, prospects, and support contacts.
- Data may include identity, contact, account, conversation, order, device, and support information selected by the customer.
- Processing includes collection, storage, retrieval, analysis, generation, transmission to configured integrations, support, and deletion for the service term and retention period.
03Security and confidentiality
The completed operator-specific addendum must identify binding personnel and subprocessor confidentiality obligations and the approved technical and organizational measures. The current application provides HTTPS deployment requirements, tenant-scoped access, audit records, and secrets separation; backup, recovery, staffing, and review commitments require operator verification.
04Subprocessors
The customer authorizes subprocessors needed to provide the service subject to equivalent data-protection obligations. The operator will maintain a current list and a reasonable notice and objection process for material additions before public launch.
05Assistance and incidents
Taking into account the nature of processing, the operator will reasonably assist with rights requests, security obligations, impact assessments, and regulator inquiries. Confirmed personal-data breaches will be notified without undue delay with available scope, impact, mitigation, and contact information.
06Transfers
Restricted international transfers will use a lawful transfer mechanism. Where applicable, the parties incorporate the current standard contractual clauses with modules, law, forum, authority, and annexes completed in an executed version.
07Return and deletion
At termination, customer content must be returned or deleted according to the final operator's documented procedures, unless law requires continued retention. This release has no self-service export or retention feature, and backup lifecycle commitments require operator verification.
08Audit information
The operator will provide reasonable documentation needed to demonstrate compliance. On-site audits, certifications, liability, and fees require operator-specific commercial terms and must not be represented as completed until verified.